opendev/system-config
Code Issues Proposed changes
eadb01c5d8
system-config/playbooks/roles/mailman-site/templates/mailman_multihost.vhost.j2

116 lines
4.1 KiB
Plaintext
Raw Normal View History

Ansible mailman configs This converts our existing puppeted mailman configuration into a set of ansible roles and a new playbook. We don't try to do anything new and instead do our best to map from puppet to ansible as closely as possible. This helps reduce churn and will help us find problems more quickly if they happen. Followups will further cleanup the puppetry. Change-Id: If8cdb1164c9000438d1977d8965a92ca8eebe4df
2021-05-04 11:55:47 -07:00
<VirtualHost *:80>
ServerName {{ mailman_site.listdomain }}
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-error.log
# Possible values include: debug, info, notice, warn, error, crit,
# alert, emerg.
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-access.log combined
DocumentRoot /var/www
RewriteEngine on
Add HTTPS vhosts to mailman servers Add secondary vhosts for HTTPS to each mailman site, but don't remove the plain HTTP ones for now. Before switching to Mailman 3 we'll replace the current HTTP vhosts with blanket redirects to HTTPS. Add tests to make sure this is working, and also add a command-line test for the lists.openinfra.dev site now that it's got a first non-default list of its own. Also collect Apache logs from the test nodes so we can see for sure what might break. Change-Id: I4d93d643381f17c9a968595587909f0ba3dd6f92
2021-12-17 19:48:51 +00:00
# TODO(fungi): convert this vhost into a blanket redirect to HTTPS when ready
Ansible mailman configs This converts our existing puppeted mailman configuration into a set of ansible roles and a new playbook. We don't try to do anything new and instead do our best to map from puppet to ansible as closely as possible. This helps reduce churn and will help us find problems more quickly if they happen. Followups will further cleanup the puppetry. Change-Id: If8cdb1164c9000438d1977d8965a92ca8eebe4df
2021-05-04 11:55:47 -07:00
RewriteRule ^/$ /cgi-bin/mailman/listinfo [R]
Add mailman Web redirects for the moved staff list While the staff mailing list is hidden and private in production, that configuration is set after creation, so in our deployment tests we can absolutely verify that HTTP and HTTPS redirects for listinfo and archives work anyway. This paves the way for any further rewrites and associated testing we may need to do for other mailing lists which move between domains, as well as testing redirects we may set up as part of the v2 to v3 migration. Change-Id: I68078554a72e3b59d8192ac4339e8654a8351f52
2021-12-20 20:27:33 +00:00
RewriteCond %{HTTP_HOST} ^lists\.openstack\.org$ [nocase]
Move summitsponsors ML to openinfra Mailman site In keeping with its name change to the Open Infrastructure Foundation, the summit sponsors mailing list is moving from lists.openstack.org to lists.openinfra.dev. Set up address forwarding and Web redirects to reflect this, and move the existing mailman list entry for it in our configuration. Note that this should be a no-op when it merges, as the list move will be handled manually while deployment is temporarily disabled for the server. Change-Id: I29e1e94885fd16b0edd7001662f367caec591439
2021-12-21 19:20:02 +00:00
RewriteRule /(cgi-bin/mailman/listinfo|pipermail)/(community|foundation|foundation-board|foundation-board-confidential|goldmembers|marketing|staff|summitsponsors)(/.*|$) %{REQUEST_SCHEME}://lists.openinfra.dev/$1/$2$3 [last,redirect=permanent]
Ansible mailman configs This converts our existing puppeted mailman configuration into a set of ansible roles and a new playbook. We don't try to do anything new and instead do our best to map from puppet to ansible as closely as possible. This helps reduce churn and will help us find problems more quickly if they happen. Followups will further cleanup the puppetry. Change-Id: If8cdb1164c9000438d1977d8965a92ca8eebe4df
2021-05-04 11:55:47 -07:00
# We can find mailman here:
ScriptAlias /cgi-bin/mailman/ /usr/lib/cgi-bin/mailman/
# And the public archives:
Alias /pipermail/ /srv/mailman/{{ mailman_site.name }}/archives/public/
# Logos:
Alias /images/mailman/ /usr/share/images/mailman/
# Use this if you don't want the "cgi-bin" component in your URL:
# In case you want to access mailman through a shorter URL you should enable
# this:
#ScriptAlias /mailman/ /usr/lib/cgi-bin/mailman/
# In this case you need to set the DEFAULT_URL_PATTERN in
# /etc/mailman/mm_cfg.py to http://%s/mailman/ for the cookie
# authentication code to work. Note that you need to change the base
# URL for all the already-created lists as well.
<Directory /usr/lib/cgi-bin/mailman/>
AllowOverride None
Options ExecCGI
AddHandler cgi-script .cgi
Add support for Ubuntu Focal to our mailman ansible This switch testing of lists.openstack.org to Focal and we make a CGI env var update to accomodate newer mailman. Specifically newer mailman's CGI scripts filter env vars that it will pass through. We were setting MAILMAN_SITE_DIR to vhost our mailman installs with apache2, but that doesn't pass the filter and is removed. HOST is passed through so we update our scripts, apache vhost configs, exim, and init scripts to use the HOST env var instead. Change-Id: I5c8c70c219669e37b7b75a61001a2b7f7bb0bb6c
2021-09-12 17:02:18 -07:00
SetEnv HOST {{ mailman_site.listdomain }}
Ansible mailman configs This converts our existing puppeted mailman configuration into a set of ansible roles and a new playbook. We don't try to do anything new and instead do our best to map from puppet to ansible as closely as possible. This helps reduce churn and will help us find problems more quickly if they happen. Followups will further cleanup the puppetry. Change-Id: If8cdb1164c9000438d1977d8965a92ca8eebe4df
2021-05-04 11:55:47 -07:00
Order allow,deny
Allow from all
<IfVersion >= 2.4>
Require all granted
</IfVersion>
</Directory>
<Directory /srv/mailman/{{ mailman_site.name }}/archives/public/>
Options FollowSymlinks
AllowOverride None
Order allow,deny
Allow from all
<IfVersion >= 2.4>
Require all granted
</IfVersion>
</Directory>
<Directory /usr/share/images/mailman/>
AllowOverride None
Order allow,deny
Allow from all
<IfVersion >= 2.4>
Require all granted
</IfVersion>
</Directory>
</VirtualHost>
Add HTTPS vhosts to mailman servers Add secondary vhosts for HTTPS to each mailman site, but don't remove the plain HTTP ones for now. Before switching to Mailman 3 we'll replace the current HTTP vhosts with blanket redirects to HTTPS. Add tests to make sure this is working, and also add a command-line test for the lists.openinfra.dev site now that it's got a first non-default list of its own. Also collect Apache logs from the test nodes so we can see for sure what might break. Change-Id: I4d93d643381f17c9a968595587909f0ba3dd6f92
2021-12-17 19:48:51 +00:00
<VirtualHost *:443>
ServerName {{ mailman_site.listdomain }}
ServerAdmin webmaster@openstack.org
ErrorLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-ssl-error.log
LogLevel warn
CustomLog ${APACHE_LOG_DIR}/{{ mailman_site.listdomain }}-ssl-access.log combined
SSLEngine on
SSLProtocol All -SSLv2 -SSLv3
# Note: this list should ensure ciphers that provide forward secrecy
SSLCipherSuite ECDH+AESGCM:DH+AESGCM:ECDH+AES256:DH+AES256:ECDH+AES128:DH+AES:!AES256:!aNULL:!eNULL:!MD5:!DSS:!PSK:!SRP
SSLHonorCipherOrder on
SSLCertificateFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.cer
SSLCertificateKeyFile /etc/letsencrypt-certs/{{ inventory_hostname }}/{{ inventory_hostname }}.key
SSLCertificateChainFile /etc/letsencrypt-certs/{{ inventory_hostname }}/ca.cer
RewriteEngine on
RewriteRule ^/$ /cgi-bin/mailman/listinfo [R]
Add mailman Web redirects for the moved staff list While the staff mailing list is hidden and private in production, that configuration is set after creation, so in our deployment tests we can absolutely verify that HTTP and HTTPS redirects for listinfo and archives work anyway. This paves the way for any further rewrites and associated testing we may need to do for other mailing lists which move between domains, as well as testing redirects we may set up as part of the v2 to v3 migration. Change-Id: I68078554a72e3b59d8192ac4339e8654a8351f52
2021-12-20 20:27:33 +00:00
RewriteCond %{HTTP_HOST} ^lists\.openstack\.org$ [nocase]
Move summitsponsors ML to openinfra Mailman site In keeping with its name change to the Open Infrastructure Foundation, the summit sponsors mailing list is moving from lists.openstack.org to lists.openinfra.dev. Set up address forwarding and Web redirects to reflect this, and move the existing mailman list entry for it in our configuration. Note that this should be a no-op when it merges, as the list move will be handled manually while deployment is temporarily disabled for the server. Change-Id: I29e1e94885fd16b0edd7001662f367caec591439
2021-12-21 19:20:02 +00:00
RewriteRule /(cgi-bin/mailman/listinfo|pipermail)/(community|foundation|foundation-board|foundation-board-confidential|goldmembers|marketing|staff|summitsponsors)(/.*|$) %{REQUEST_SCHEME}://lists.openinfra.dev/$1/$2$3 [last,redirect=permanent]
Add HTTPS vhosts to mailman servers Add secondary vhosts for HTTPS to each mailman site, but don't remove the plain HTTP ones for now. Before switching to Mailman 3 we'll replace the current HTTP vhosts with blanket redirects to HTTPS. Add tests to make sure this is working, and also add a command-line test for the lists.openinfra.dev site now that it's got a first non-default list of its own. Also collect Apache logs from the test nodes so we can see for sure what might break. Change-Id: I4d93d643381f17c9a968595587909f0ba3dd6f92
2021-12-17 19:48:51 +00:00
ScriptAlias /cgi-bin/mailman/ /usr/lib/cgi-bin/mailman/
Alias /pipermail/ /srv/mailman/{{ mailman_site.name }}/archives/public/
Alias /images/mailman/ /usr/share/images/mailman/
<Directory /usr/lib/cgi-bin/mailman/>
AllowOverride None
Options ExecCGI
AddHandler cgi-script .cgi
SetEnv HOST {{ mailman_site.listdomain }}
Order allow,deny
Allow from all
Require all granted
</Directory>
<Directory /srv/mailman/{{ mailman_site.name }}/archives/public/>
Options FollowSymlinks
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
<Directory /usr/share/images/mailman/>
AllowOverride None
Order allow,deny
Allow from all
Require all granted
</Directory>
</VirtualHost>
Copy Permalink